(rocketmq-dashboard) branch rocketmq-studio updated: fix(security): block loopback IP in data source SSRF guard (#1423)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new a4bcba05 fix(security): block loopback IP in data source SSRF guard 
(#1423)
a4bcba05 is described below

commit a4bcba05b7319ab844ace965899d8e63979dd696
Author: Yu Xinqiang <yu2651701...@tju.edu.cn>
AuthorDate: Tue Aug 11 00:26:32 2026 +0800

    fix(security): block loopback IP in data source SSRF guard (#1423)
    
    The isAllowedDataSourceHost method blocked 'localhost' by string
    comparison but did not check isLoopbackAddress(), allowing 127.0.0.1
    to bypass the SSRF guard.
    
    Fixes #1422
---
 .../java/org/apache/rocketmq/studio/settings/SettingsService.java     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java 
b/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
index 2e8023c8..aef4f15a 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
@@ -266,7 +266,9 @@ public class SettingsService {
         }
         try {
             InetAddress address = InetAddress.getByName(normalized);
-            return !address.isAnyLocalAddress() && 
!address.isLinkLocalAddress();
+            return !address.isAnyLocalAddress()
+                    && !address.isLinkLocalAddress()
+                    && !address.isLoopbackAddress();
         } catch (UnknownHostException exception) {
             // Unresolvable host: let the connection attempt surface the real 
connectivity error.
             return true;